The UK’s data regulator has fined Reddit £14.47 million ($19.5 million) for failing to protect the privacy of children on its platform. The Information Commissioner’s Office (ICO) ruled that Reddit did not implement sufficient age checks, allowing children under 13 to access the site and have their data collected unlawfully.
What Happened
The ICO investigation concluded that Reddit breached UK data protection laws by relying on weak age verification methods. According to the ICO's official announcement, the platform failed to ensure that children under 13 were not using the service. While Reddit's terms of service prohibit users under 13, the regulator found that self-declaration—simply asking a user to enter their birth date—was insufficient to stop young children from creating accounts.
Information Commissioner John Edwards stated that children’s data was collected in ways they could not "understand, consent to or control," potentially exposing them to inappropriate and harmful content. Additionally, the investigation revealed that Reddit failed to conduct a mandated Data Protection Impact Assessment (DPIA) regarding risks to children until January 2025, despite knowing that teenagers aged 13 to 17 used the platform.
The Bigger Picture
This fine signals a major shift in how online platforms must handle age verification. For years, apps have relied on users to truthfully input their age. However, regulators now demand robust age assurance. This involves using technology to estimate age or verify identity, rather than trusting a simple checkbox.
The push for stricter checks aligns with the UK’s Children’s Code, which requires online services to provide high privacy settings by default for users under 18. As we previously reported, data privacy and safety assessments are becoming critical for any digital tool accessed by students. The ICO has made it clear that if a platform cannot distinguish between an adult and a child with certainty, it must apply the strictest privacy protections to all users.
Reddit has argued that strict age verification conflicts with its commitment to user anonymity. However, the regulator emphasized that companies must find a balance that does not leave children exposed to risks through the misuse of their data. This enforcement follows similar actions against other platforms, such as Imgur, for failing to identify minors.
What This Means for Families
For parents, this ruling confirms that age limits on social media platforms are often effectively optional without technical enforcement. If a platform relies solely on self-declaration, there is no digital barrier preventing a child from accessing adult-oriented communities.
Educators should be aware that popular discussion platforms may not have robust safeguards in place to filter content or data collection for younger students. While Reddit has since introduced age verification for mature content, the regulator’s stance suggests that basic account creation still poses a risk if age checks remain easily bypassable.
What You Can Do
- Check the verification method: When your child signs up for a new app, observe if it simply asks for a birthdate or requires actual verification (like an ID check or facial estimation).
- Discuss "fake" birthdays: Explain to children that falsifying their age to bypass checks removes legal protections designed to keep their data private and safe.
- Review privacy defaults: Ensure that any account your teen creates is set to the highest privacy settings available, regardless of the platform’s default behavior.